Slashdot Mirror
Hackers Clone E-Passport
mrops writes "I guess the skeptical Slashdot community always knew that e-passports are a big waste of time and money; now German security consultants have been able to successfully clone e-passports, even onto building access cards. FTA: 'The whole passport design is totally brain damaged,' Grunwald says. 'From my point of view all of these RFID passports are a huge waste of money. They're not increasing security at all.'"
But this unfortunately is not going to stop the governments from wasting money on them.
Our money.
Probably the better question is "will the bad guys be willing to risk trying this?" No doubt there'll be an endless stream of stolen passport data available on line from crooked hotel clerks -- skimmed e-passport RFID data will be the next hot hacker item for sale.
John
After reading this article, the RFID thing isn't nearly as bad as I thought.
1) They aren't eliminating the physical passports. So all the physical protections (watermarking) still apply.
2) They are shielding the passports so they can't be remotely read.
3) You need to send a cryptographic key which makes it even more difficult to read remotely (although I don't understand how this works).
4) They are hard to tamper with because of the hashes (assuming they are good hashes, this is comparable to watermarks).
Having said that, I'm not sure why the RFID thing is even useful. A bar code would be simpler, although no more or less tamper proof. And there are existing machines which can read passports by scanning them and OCRing. They are very reliable since passports use high-quality printed text with the characters in known fonts and positions.
It doesn't give away a lot, it doesn't have to. A passport must be inspectable by anyone so the spec on how to read it must be pretty much public. There is an (optional) electronic signature mechanism, but this predicates an international public key infrastructure. The bank where I work has enough problems getting one of those together, let alone an international organisation. PKI is very hard. Google for references on this.
Key compromise means that all issues documents are then compromised. Can you imagine a country recalling all its passports?
See my journal, I write things there
Ya know, there is not a thing that Homeland Security has done that has made us more secure. Even the one or two instances where they actually tracked down a terrorist cell instead of wasting government money on vacations and useless Katrina relief trailers could easily have been done by the individual agencies themselves.
It's almost difficult to fathom what anyone that requires this shit is thinking. There is no evaulation of technology, and a complete lack of understanding of security. Unfortunately, those that make the decisions often disregard for political reasons the constant cries of the actual technology folks in those agencies that actually point out these flaws. Unfortunately, their cries fall on deaf ears (although, a big thanks for not giving up the good fight). But politics outweighs information, and RFID gets put into passports, despite the overwhelming evidence that they are a very bad idea.
Almost all of this is politically motivated now, in one of two avenues - to "appear" to be taking some action to protect security, or in an effort to more easily collect information on anyone that steps foot one into this country - be ye citizen or visitor.
Checks and balances, being the glory of the past but just about dead now, make sure that these unilateral decisions can be made without any oversite. And with Bush just giving himself more power (a parody, but eerily poignant) there is no end in site to this stupidity.
Excuse my speling.
Making The Bar Project
"Seriously why is this a big deal? .. as far as I understand it is an additional measure of security, not the only measure", MoneyT
Allow me to explain it to you. The move to e-passports was so as you couldn't counterfeited them like the paper ones. One of the measures required, if not the primary one is the ability to not be cloned. Thats why they call them e-passports
"his grand achievement is... what? That that a fellow called John Smith could thus make a fake passport that still says John Smith?", Moraelin
No, that a follow called Osama could pass through an airport if it used electronic scanning. Or as the article mentions an electronic device could be activated when 'John Smith' opened his passport.
The same lack of thought seems to have gone into fingerprint scanning. As this article demonstrates it is possible to forge these as you leave your prints all over the place.
davecb5620@gmail.com
In order to be "secure" against fakery a passport, or any document should:
1) Have an digital signature of all the data, or at least a signature of a strong one-way hash.
2) Have a means to verify the signature, and that the signer's key hasn't been repudiated.
3) Have a means to verify the hash is legit, i.e. rehash the data on the spot.
4) Have a means to verify the data in question matches the printed version of the document, e.g. a computer screen that shows the digitized picture and the other data that should be on the printed document. A human, or perhaps a computer, can then compare that with the actual document.
Steps 1, 2, and 3 are at the heart of any digitally-signature-validation scheme. Step #4 will detect misuse, as someone using a cloned passport will "look" the same as someone using a stolen-but-legitimate one to the checker.
An alternative, where bandwidth is available, is to have the document-issuing authority validate the document: Upload the document to the authority, and have it send back a "valid" or "not valid" response. This is essentially what happens with credit cards: the name, card #, and expiration date are passed on to the bank or the bank's agent, and the merchant gets back a code saying "card is valid," "card not valid," or one of several other codes such as "card reported stolen/missing."
There are still 2 problems with this approach:
1) The identical twin or look-alike problem.
2) Privacy issues if passport data is compromised.
The twin problem is mitigated by the digitized version of the handwritten signature, a fingerprint, notation of scars, or other items which look-alikes are less likely to share. Privacy issues are in principle no more than they are today with stolen passports, ASSUMING no information that is not on the printed passport finds its way to the embedded electronic data. However, electronic data is much easier to deliver to fraudsters than paper data, and passport theives aren't likely to spend the time typing or scanning in data from a paper passport. The best cure for this is to encrypt the data.
RFID is not required for a secure document. All RFID does is make the data easier to read, which is good for those who want to read the passports without contact them, be they freind or foe. Hmm, maybe someone should invent an RFID tag with an "on" switch.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
An insecure, RFID-driven passport is the perfect thing for making it too dangerous for Americans to travel safely abroad. If an American had one of these in Lebanon, Hezbollah could walk through a public place with a RFID reader and discretely find some good targets of hostage-taking opportunity. It'd be easier for the Chinese police, for example, to track American visitors.
Don't go abroad! Don't see the world except through the lens of CNNABCCBSNBCFOXNPR! That's how the political class wants it. A population that is scared to travel is a population that can't as easily see the world on its own and make its own decisions.
I'm not even an expert in the field, but an RFID tag with an "on" switch seems pretty obvious. Just put the switch between the antenna and the rest of the device. It can be either a traditional on-off switch or a pressure-sensitive "off when not pressed" switch. Imagine an RFID-enabled passport that ONLY broadcasts when someone was holding down the "broadcast" switch.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
OK, seriously. You sound like George Bush. Just stop talking.
... uh ... looking at a piece of paper that could be edited by anyone with enough time and the holograms to make it look right.
Let me explain this as simple as possible so that I'm sure that we're all on the same page:
Someone can duplicate the DATA on a passport and NOT edit it, and you say 'OMFGZ OSAMA BIN LADEN ROFLOL'.
Give the Osama argument a rest.
Let us play out this scenario of yours:
Osama Bin Laden finds himself in possession of a stolen/cloned passport for one 'John Smith' of the USA.
This passport, while stolen and cloned, is still digitally signed -- meaning that the information on it cannot be changed.
Osama Bin Laden attempts to enter the USA with this passport.
The electronic scanner reads 'John Smith' and provides a picture of 'John Smith'.
Osama Bin Laden is NOT 'John Smith'.
Osama Bin Laden is taken into custody.
The only way that "Osama could pass through an airport if it used electronic scanning" is if he found a way to re-digitally sign the contents of the passport, OR if he could do enough facial modification that he looked like 'John Smith'.
So, what we're saying is, if he's willing to do the plastic surgery or to spend the time to crack the RSA encryption on the contents of the RFID chip and is able to RE-digitally sign it after he edits it, he can get into the country. Gee. Sounds a lot less secure than our current method of
Or, the more likely scenario, he'll just waltz across the Mexican border because the USA doesn't seem to give a crap about the fact that thousands of people illegally cross it daily. Without passports. Or extensive facial modification.
On to your second mention that someone could have an electronic device that activates when an RFID chip is within range:
YIPPEE. Anyone could make an electronic device that would activate when your Chase Blink card or your FastPass or your Building Key Card is within range. THIS IS NOT NEW, NOR IS IT EXCITING OR DANGEROUS.
Quit with the FUD posts and actually take a step back to find out that, YES, RFID passports are not perfect. YES, the concept has its inherent flaws. NO, they really aren't (yet) worse than the standard passport flaws. NO, this does not mean that you can just drop a FUD post about Osama getting into the airport because of it without any factual basis behind it, whatsoever.
To the darkened skies once more, and ever onward.
Just wait it out. A year from now they will see they made a mistake. Unfortunately it will be at the expense of travelers. But hey the only way politicians will listen is after the bad thing you predict will happen happens. They only wear hindsite glasses.
Can I bum a sig?
While I 100% agree with your first paragraph, it's just a "something must be done!" kind of response to keep the voters happy and concentrate power in DC.
Your next couple of points should be reconsidered carefully:
There is no evaulation of technology
On the contrary, there is quite a bit of evaluation of technology. Only the U.S. gov't can afford to pay people to spend the time to come up with these torture tests. My current employer was very briefly involved early on in the process for the new U.S. passport and I can tell you the tests the Feds came up with are very high quality tests that have improved the technology and force companies to better comply with ISO standards.
Please consider RFID passports as a response to the demand for *much* more international travel in even larger planes. In order to more accurately process many more people through customs at airports around the world, this is a good way to do it more efficiently.
Finally, I believe no one is claiming they are "secure" as in magically impenetrable. They are not. And like most security systems, the critical control points of entry are probably not staffed by the "brightest and best" so the usual systemic failures will occur. Only, the wait at customs will be a little shorter and govt's will have more data (not necessarily better or higher quality!) as to who is entering when.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html